Kibana 'reset' after 6.2.1 update - missing patterns, visualizations, dashboards

[ocabj (Jonathan Ocab)]

Apparently, after I updated to 6.2.1 and restarted services, all my kibana patters, visualizations, and dashboards are gone. Any idea if these can be recovered?

[lukas (Lukas Olson)]

Hmm... Are the still in Elasticsearch, just not showing up in Kibana?

[rcowart (Rob Cowart)]

I was lucky enough to recreate a single index pattern and then everything somehow started working again. So maybe just try that.

Depending on which version you are coming from you may be really unhappy with how things are rendered since 6.1.0. Finding and fixing all of the excessive padding, poor font smoothing and other issues was a painful task. We have been recommending customers to stick with 5.6 (or 6.0) until these Kibana issues are addressed. It is sad because there are some really useful features hidden away in the newer versions, but the User Experience is being destroyed by poor design choices.

[Rogier75 (Rogier Taal)]

Same problem here.

Running kibana-6.2.1
Migrated from kibana-5.6.4

Visualizations exist in the database. Some I can see others I cannot see in Kibana 6.2.1

The ones I can see have the following id: 'visualization' followed by a checksum
{
"_index": ".kibana-6",
"_type": "doc",
"_id": "visualization:AV-b6hJgu2BmwybUOY-W"
}

The ones that I cannot see look this this:
{
"_index": ".kibana-6",
"_type": "doc",
"_id": "visualization:KPI-of-unique-messages"
}

Update and fix:

The problem was that I ran the Kibana 6 update guide on this page: https://www.elastic.co/guide/en/kibana/6.x/migrating-6.0-index.html

That page says to reindex: ctx._source = [ ctx._type : ctx._source ], which is incorrect.

If you run that reindexing scheme it will produce this body structure:

{
  "doc": {
    "visualization": {    },
    "type": "visualization"
  },
  "type": "doc"
}

Where it should be:
{
  "visualization": {    },
  "type": "visualization"
}

So I ended up reinindexing by removing the outer "doc" and setting type to visualisation.

Update 2:
For Visualizations created in older Kibana versions (pre 5.0 ...?)
the field:

kibanaSavedObjectMeta.searchSourceJSON

will have the search index set to the search index display name. For instance:

    "kibanaSavedObjectMeta": {
      "searchSourceJSON": "{\"index\":\"jenkins*\",\"query\":{\"query_string\":{\"query\":\"att.id:*\",\"analyze_wildcard\":true}},\"filter\":[]}"
    }

Current Kibana has the index set to the checksum of the document that contains the search index for instance:

    "kibanaSavedObjectMeta": {
      "searchSourceJSON": "{\"index\":\"af1fd970-1358-11e8-b5d6-ab6f6a92f873\",\"query\":{\"query_string\":{\"query\":\"att.id:*\",\"analyze_wildcard\":true}},\"filter\":[]}"
    }

I had to reindex all visualizations and replace the index inside:

source['visualization']['kibanaSavedObjectMeta']['searchSourceJSON']

to the checksum of the search index.

Now I have all my visualizations back.